new connection event

[Oleg Ostanin]

Hello igniters! I wonder if we can add a new event for a failed ssl
connection? Considering security hazards it can be quite helpful to get
notifications in case someone unauthorized is trying to connect to the
cluster. I've created a small pull-request to illustrate a possible
solution.
https://github.com/apache/ignite/pull/8139
Please tell me what do you think.

[Ilya Kasnacheev]

Hello!

I'm not sure this is a good event. Events are computer-processable, while
SSL error either needs attention from a human or none at all.

Then again, sometimes it's not an SSL error (come to think or it,
unauthorized people tend to not use SSL since success is not an option
here) but any unexpected input. Such input will mean that something (or
somebody) wrong is trying to connect, possibly using a wrong port or hoping
that SSL is disabled.

Maybe we need a simple warning. I guess we already have it, actually. Don't
we?

Regards,
--
Ilya Kasnacheev


вт, 11 авг. 2020 г. в 14:27, Oleg Ostanin <[hidden email]>:

> Hello igniters! I wonder if we can add a new event for a failed ssl
> connection? Considering security hazards it can be quite helpful to get
> notifications in case someone unauthorized is trying to connect to the
> cluster. I've created a small pull-request to illustrate a possible
> solution.
> https://github.com/apache/ignite/pull/8139
> Please tell me what do you think.
>

[Oleg Ostanin]

Thank you for the response. Yes, we have a simple warning in log, but in
case SSL error needs an immediate human attention it would be better to set
a listener for such events.

вт, 11 авг. 2020 г. в 17:59, Ilya Kasnacheev <[hidden email]>:

> Hello!
>
> I'm not sure this is a good event. Events are computer-processable, while
> SSL error either needs attention from a human or none at all.
>
> Then again, sometimes it's not an SSL error (come to think or it,
> unauthorized people tend to not use SSL since success is not an option
> here) but any unexpected input. Such input will mean that something (or
> somebody) wrong is trying to connect, possibly using a wrong port or hoping
> that SSL is disabled.
>
> Maybe we need a simple warning. I guess we already have it, actually. Don't
> we?
>
> Regards,
> --
> Ilya Kasnacheev
>
>
> вт, 11 авг. 2020 г. в 14:27, Oleg Ostanin <[hidden email]>:
>
> > Hello igniters! I wonder if we can add a new event for a failed ssl
> > connection? Considering security hazards it can be quite helpful to get
> > notifications in case someone unauthorized is trying to connect to the
> > cluster. I've created a small pull-request to illustrate a possible
> > solution.
> > https://github.com/apache/ignite/pull/8139
> > Please tell me what do you think.
> >
>

[Ilya Kasnacheev]

Hello!

Why not the Failure Handler then?

(I'm only half-joking).

Regards,

--
Ilya Kasnacheev


ср, 12 авг. 2020 г. в 09:54, Oleg Ostanin <[hidden email]>:

> Thank you for the response. Yes, we have a simple warning in log, but in
> case SSL error needs an immediate human attention it would be better to set
> a listener for such events.
>
> вт, 11 авг. 2020 г. в 17:59, Ilya Kasnacheev <[hidden email]>:
>
> > Hello!
> >
> > I'm not sure this is a good event. Events are computer-processable, while
> > SSL error either needs attention from a human or none at all.
> >
> > Then again, sometimes it's not an SSL error (come to think or it,
> > unauthorized people tend to not use SSL since success is not an option
> > here) but any unexpected input. Such input will mean that something (or
> > somebody) wrong is trying to connect, possibly using a wrong port or
> hoping
> > that SSL is disabled.
> >
> > Maybe we need a simple warning. I guess we already have it, actually.
> Don't
> > we?
> >
> > Regards,
> > --
> > Ilya Kasnacheev
> >
> >
> > вт, 11 авг. 2020 г. в 14:27, Oleg Ostanin <[hidden email]>:
> >
> > > Hello igniters! I wonder if we can add a new event for a failed ssl
> > > connection? Considering security hazards it can be quite helpful to get
> > > notifications in case someone unauthorized is trying to connect to the
> > > cluster. I've created a small pull-request to illustrate a possible
> > > solution.
> > > https://github.com/apache/ignite/pull/8139
> > > Please tell me what do you think.
> > >
> >
>

[Zhenya Stanilovsky]

may be jmx would be enough here ?

 

>Hello!
>
>Why not the Failure Handler then?
>
>(I'm only half-joking).
>
>Regards,
>
>--
>Ilya Kasnacheev
>
>
>ср, 12 авг. 2020 г. в 09:54, Oleg Ostanin < [hidden email] >:
> 
>> Thank you for the response. Yes, we have a simple warning in log, but in
>> case SSL error needs an immediate human attention it would be better to set
>> a listener for such events.
>>
>> вт, 11 авг. 2020 г. в 17:59, Ilya Kasnacheev < [hidden email] >:
>>
>> > Hello!
>> >
>> > I'm not sure this is a good event. Events are computer-processable, while
>> > SSL error either needs attention from a human or none at all.
>> >
>> > Then again, sometimes it's not an SSL error (come to think or it,
>> > unauthorized people tend to not use SSL since success is not an option
>> > here) but any unexpected input. Such input will mean that something (or
>> > somebody) wrong is trying to connect, possibly using a wrong port or
>> hoping
>> > that SSL is disabled.
>> >
>> > Maybe we need a simple warning. I guess we already have it, actually.
>> Don't
>> > we?
>> >
>> > Regards,
>> > --
>> > Ilya Kasnacheev
>> >
>> >
>> > вт, 11 авг. 2020 г. в 14:27, Oleg Ostanin < [hidden email] >:
>> >
>> > > Hello igniters! I wonder if we can add a new event for a failed ssl
>> > > connection? Considering security hazards it can be quite helpful to get
>> > > notifications in case someone unauthorized is trying to connect to the
>> > > cluster. I've created a small pull-request to illustrate a possible
>> > > solution.
>> > >  https://github.com/apache/ignite/pull/8139
>> > > Please tell me what do you think.
>> > >
>> >
>>